SIGRed

Repository purpose: a Python proof-of-concept/operational DoS exploit for SIGRed (CVE-2020-1350) against Microsoft Windows DNS Server. Structure: - README.md: explains SIGRed DoS flow, required setup (attacker-controlled domain with authoritative NS pointing to attacker), and how to trigger using nslookup for SIG records on subdomain “9.<domain>”. - sigred_dos.py: the actual exploit server. It implements a minimal malicious DNS authoritative server on port 53 for both UDP and TCP. - tools/command.txt: debugging helpers (enable page heap for dns.exe and capture dumps with procdump). Exploit capabilities (what the code does): - Starts two daemon threads: - udp_server(): listens on UDP/53 and responds to incoming DNS queries with a response containing an SOA record in the authority section (NSCOUNT=1, ANCOUNT=0). It largely echoes the question section from the request and appends a crafted SOA record using name compression (0xC00C pointer). - tcp_server(): listens on TCP/53, accepts DNS-over-TCP queries, and returns a crafted DNS response containing a SIG (type 0x0018) answer. The SIG RDATA is constructed to be extremely large (padded to ~65KB) and includes repeated 0x0f + 0xff*15 patterns; the intent is to trigger the SIGRed integer overflow/undersized allocation condition in the Windows DNS server’s SIG record parsing, resulting in a crash (DoS). Notable implementation details: - The script takes a single argument: the attacker-controlled domain (e.g., ibrokethe.net) and converts it into DNS label format (domain_compressed). - It binds to 0.0.0.0:53 for both protocols, so it is meant to be run as a privileged process (or with capabilities) on the attacker’s authoritative DNS host. - The README indicates the victim trigger is a SIG query for the required subdomain label “9”, e.g., `nslookup -type=sig 9.example.com <target_dns>`. Overall: This is not a scanner/detector; it is an exploit service that delivers malicious DNS protocol payloads to crash vulnerable Windows DNS servers (DoS).

This repository contains a proof-of-concept exploit for CVE-2020-1350 (SIGRed), a critical vulnerability in Microsoft Windows DNS Server. The exploit consists of a single Python script ('sigred_dos.py') that acts as a malicious DNS server. When run with a domain name as an argument, it listens on both UDP and TCP port 53, responding to DNS SIG record queries with a specially crafted payload that triggers a memory corruption and crashes the vulnerable Windows DNS service. The README provides detailed setup and usage instructions, including the requirement to control a domain and configure its nameservers to point to the attacker's server. The exploit is designed for denial-of-service (DoS) and does not provide remote code execution. The repository is well-documented, with clear instructions and references to the original vulnerability research. No hardcoded IP addresses or domains are present; the script is parameterized by the attacker's chosen domain.

This repository is a proof-of-concept exploit for CVE-2020-1350 (SIGRed), a critical remote code execution vulnerability in Microsoft Windows DNS Server. The repository contains two Python scripts: TCP_Response.py and UDP_Response.py. Both scripts implement custom DNS servers (one for TCP, one for UDP) that listen on port 53. The UDP server is used to trigger a truncated DNS response, forcing the target to retry the query over TCP, where the TCP server delivers a maliciously crafted DNS SIG response with an oversized signature field. This response is designed to exploit the buffer overflow in the Windows DNS server. The README provides setup and usage instructions, including configuring a Windows Server 2016 DNS server to forward queries to the attacker's Linux box running these scripts. The exploit does not include a post-exploitation payload; its purpose is to trigger the vulnerability and demonstrate the crash or potential code execution. The main attack vector is network-based, targeting DNS services over both UDP and TCP. The scripts are written in Python and are intended for research and demonstration purposes.